From patchwork Tue Oct 18 17:17:06 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: andrey.konovalov@linux.dev X-Patchwork-Id: 4264 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:4ac7:0:0:0:0:0 with SMTP id y7csp2076075wrs; Tue, 18 Oct 2022 10:29:51 -0700 (PDT) X-Google-Smtp-Source: AMsMyM4RKRH91xQOUexePWIF3rIZkbsKhVorZC5oU0cmlk1eezwGkqqh/dctqrwswFPJispVdn8M X-Received: by 2002:a17:90a:e2c3:b0:209:9af2:4e1a with SMTP id fr3-20020a17090ae2c300b002099af24e1amr41688684pjb.44.1666114190382; Tue, 18 Oct 2022 10:29:50 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1666114190; cv=none; d=google.com; s=arc-20160816; b=WOxprqTtrpJKCAaykwLIG7uTF5oJzPw+7IPBHJiqhLlNbzU9vh1dYlvXeUXcbQWHh7 0muCMlj9Qb4v7+Yj7tvYUm1gMwULH0Ko0ZdQIZ/8pVoHgcsHfICgVIHRLlOdLAe7DCFk 0K7B9v1JvIx1aisxtfNor0KRn5FBcA5J4B3nKcTvUKDidfV56ndCMDkkkBMbhDPJCaeP SGVEABkDLkY+ddefZlbiRjNHaLHnfWFxEOywnltGCNfk1bZxetxqHA477VNCcb/sQe6+ jnMMqs0saSd+DsdmR1mX6JhcabwuZpTdcADZuq0HlTxSn+wDf/Av4iStkz+q5x4JBJIK Po8g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=7sMEqDPOnA0B1xo/BBovBSGH55UI1F4ZzoT+c6nAvV4=; b=wWwZVlW66JNJ6+4etXqQ/FOu/V+XN8ecobA38KauNBtnNd8JDZQN8mYbuZwo1UIWCb aYqTi5/U6bzouDQjAIRz89wQmJ8M0RolZCDDSj44/CrY9PXri0oKHAvjXKiqMqLVgEsg 1oDRc3a+wPfUQbadZBE17pJhW6FCkT3pe/AvectDysKPt/S58ToqyhGwxpduV0ztscgT mpYq+84tynBoLZLjAuxYGKRbarM66drAwh8Jmpsg0ZZWPHadmCb7cEE1iV+6GCEU3nPC bk+sbw12GVkMnGnGj814Gq0B7c8EBlUxxalss1J/uJ+g4iulgHJNOoMtf7BdkAi93tb3 r2Ww== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linux.dev header.s=key1 header.b=iQpOwSCL; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linux.dev Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id mu7-20020a17090b388700b0020b1f42bf47si17515304pjb.112.2022.10.18.10.29.36; Tue, 18 Oct 2022 10:29:50 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@linux.dev header.s=key1 header.b=iQpOwSCL; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linux.dev Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229994AbiJRRRP (ORCPT + 99 others); Tue, 18 Oct 2022 13:17:15 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59072 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229746AbiJRRRN (ORCPT ); Tue, 18 Oct 2022 13:17:13 -0400 Received: from out2.migadu.com (out2.migadu.com [188.165.223.204]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id F1D73A2A96 for ; Tue, 18 Oct 2022 10:17:11 -0700 (PDT) X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1666113430; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=7sMEqDPOnA0B1xo/BBovBSGH55UI1F4ZzoT+c6nAvV4=; b=iQpOwSCLZjzJ52HhFXaIUvgFQ1sUWc4Sc9mt8RosAmIo8bQnSklMNwaQpWMQIBavCfsZ/X ELYid2RnVBuJjL7uKJah1g3sJuR8mpsKtJhJ7qrO5piVxy2cFIa7J1uhE+kEUOxuE6Gpdp 6D/jHBZckDcxA2Um5/ChnTrtAQsS3Zo= From: andrey.konovalov@linux.dev To: Andrew Morton Cc: Andrey Konovalov , Marco Elver , Alexander Potapenko , Dmitry Vyukov , Andrey Ryabinin , kasan-dev@googlegroups.com, linux-mm@kvack.org, linux-kernel@vger.kernel.org, Andrey Konovalov Subject: [PATCH v3 3/3] kasan: migrate workqueue_uaf test to kunit Date: Tue, 18 Oct 2022 19:17:06 +0200 Message-Id: <3a28fa0c89771e47418fb2d5f0e009c83aec5eba.1666113393.git.andreyknvl@google.com> In-Reply-To: References: MIME-Version: 1.0 X-Migadu-Flow: FLOW_OUT X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,SPF_HELO_PASS,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1747047353555664308?= X-GMAIL-MSGID: =?utf-8?q?1747047353555664308?= From: Andrey Konovalov Migrate the workqueue_uaf test to the KUnit framework. Initially, this test was intended to check that Generic KASAN prints auxiliary stack traces for workqueues. Nevertheless, the test is enabled for all modes to make that KASAN reports bad accesses in the tested scenario. The presence of auxiliary stack traces for the Generic mode needs to be inspected manually. Reviewed-by: Marco Elver Signed-off-by: Andrey Konovalov --- Changed v2->v3: - Rebased onto 6.1-rc1 --- mm/kasan/kasan_test.c | 40 +++++++++++++++++++++++++++++------- mm/kasan/kasan_test_module.c | 30 --------------------------- 2 files changed, 33 insertions(+), 37 deletions(-) diff --git a/mm/kasan/kasan_test.c b/mm/kasan/kasan_test.c index 38bf6ed61cb8..e27591ef2777 100644 --- a/mm/kasan/kasan_test.c +++ b/mm/kasan/kasan_test.c @@ -1141,6 +1141,14 @@ static void kmalloc_double_kzfree(struct kunit *test) KUNIT_EXPECT_KASAN_FAIL(test, kfree_sensitive(ptr)); } +/* + * The two tests below check that Generic KASAN prints auxiliary stack traces + * for RCU callbacks and workqueues. The reports need to be inspected manually. + * + * These tests are still enabled for other KASAN modes to make sure that all + * modes report bad accesses in tested scenarios. + */ + static struct kasan_rcu_info { int i; struct rcu_head rcu; @@ -1155,13 +1163,6 @@ static void rcu_uaf_reclaim(struct rcu_head *rp) ((volatile struct kasan_rcu_info *)fp)->i; } -/* - * Check that Generic KASAN prints auxiliary stack traces for RCU callbacks. - * The report needs to be inspected manually. - * - * This test is still enabled for other KASAN modes to make sure that all modes - * report bad accesses in tested scenarios. - */ static void rcu_uaf(struct kunit *test) { struct kasan_rcu_info *ptr; @@ -1177,6 +1178,30 @@ static void rcu_uaf(struct kunit *test) rcu_barrier()); } +static void workqueue_uaf_work(struct work_struct *work) +{ + kfree(work); +} + +static void workqueue_uaf(struct kunit *test) +{ + struct workqueue_struct *workqueue; + struct work_struct *work; + + workqueue = create_workqueue("kasan_workqueue_test"); + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, workqueue); + + work = kmalloc(sizeof(struct work_struct), GFP_KERNEL); + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, work); + + INIT_WORK(work, workqueue_uaf_work); + queue_work(workqueue, work); + destroy_workqueue(workqueue); + + KUNIT_EXPECT_KASAN_FAIL(test, + ((volatile struct work_struct *)work)->data); +} + static void vmalloc_helpers_tags(struct kunit *test) { void *ptr; @@ -1509,6 +1534,7 @@ static struct kunit_case kasan_kunit_test_cases[] = { KUNIT_CASE(kasan_bitops_tags), KUNIT_CASE(kmalloc_double_kzfree), KUNIT_CASE(rcu_uaf), + KUNIT_CASE(workqueue_uaf), KUNIT_CASE(vmalloc_helpers_tags), KUNIT_CASE(vmalloc_oob), KUNIT_CASE(vmap_tags), diff --git a/mm/kasan/kasan_test_module.c b/mm/kasan/kasan_test_module.c index 4688cbcd722d..7be7bed456ef 100644 --- a/mm/kasan/kasan_test_module.c +++ b/mm/kasan/kasan_test_module.c @@ -62,35 +62,6 @@ static noinline void __init copy_user_test(void) kfree(kmem); } -static noinline void __init kasan_workqueue_work(struct work_struct *work) -{ - kfree(work); -} - -static noinline void __init kasan_workqueue_uaf(void) -{ - struct workqueue_struct *workqueue; - struct work_struct *work; - - workqueue = create_workqueue("kasan_wq_test"); - if (!workqueue) { - pr_err("Allocation failed\n"); - return; - } - work = kmalloc(sizeof(struct work_struct), GFP_KERNEL); - if (!work) { - pr_err("Allocation failed\n"); - return; - } - - INIT_WORK(work, kasan_workqueue_work); - queue_work(workqueue, work); - destroy_workqueue(workqueue); - - pr_info("use-after-free on workqueue\n"); - ((volatile struct work_struct *)work)->data; -} - static int __init test_kasan_module_init(void) { /* @@ -101,7 +72,6 @@ static int __init test_kasan_module_init(void) bool multishot = kasan_save_enable_multi_shot(); copy_user_test(); - kasan_workqueue_uaf(); kasan_restore_multi_shot(multishot); return -EAGAIN;